https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:45:48.939805+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-33575 BREW-openclaw-cli-CVE-2026-33575 — OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens 2026-10-03T06:45:48.944519+00:00

Affected: Homebrew: openclaw-cli

### Summary

OpenClaw pairing setup codes generated by `/pair` and `openclaw qr` embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential.

### Impact

An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to `2026.3.12` or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.

 https://cve.radiocsirt.org/vuln/cnvd-2026-16691 cnvd-2026-16691 2026-10-03T06:45:48.944595+00:00 cnvd-2026-16691 https://cve.radiocsirt.org/vuln/euvd-2026-329491 EUVD-2026-329491 2026-10-03T06:45:48.944622+00:00 EUVD-2026-329491 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33575 fkie_cve-2026-33575 2026-10-03T06:45:48.944641+00:00

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

 https://cve.radiocsirt.org/vuln/ghsa-6rxp-6g9v-64v8 GHSA-6rxp-6g9v-64v8 2026-10-03T06:45:48.944674+00:00

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0711 WID-SEC-W-2026-0711 — OpenClaw: Mehrere Schwachstellen 2026-10-03T06:45:48.944697+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.